CVE-2026-9733: Mojolicious OAuth2 Plugin for Perl: Predictable Default State Parameter (CWE-338)

Overview

The record describes Mojolicious::Plugin::Web::Auth::OAuth2 for Perl, a plugin for the Mojolicious web framework that handles OAuth2 authorization flows. When no state generator is set in the constructor, the plugin falls back to a SHA-1 hash built from predictable, low-entropy inputs, including the epoch time exposed through the HTTP Date header and Perl's built-in rand function. The record classifies the weakness as CWE-338, a use of a weak pseudo-random generator.

Impact

The record states that a predictable state value allows an attacker to hijack another user's session through cross-site request forgery. The state parameter is meant to bind an authorization response to the session that started it, so a guessable value weakens that protection. The CNA scores the issue at CVSS 3.1 base 9.1, with a network attack vector, low complexity, no privileges required and no user interaction, and high confidentiality and integrity impact.

Affected products and versions

• The description names Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl.
• The structured affected list in the record is empty, so the exact version range is only as precise as the description.
• The record lists no fixed version.
• The record references a patch file for release 0.17 hosted on the MetaCPAN security site. The record does not state whether that patch is the official fix or what it changes.

Exploitation status

The record shows that the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

• Inventory applications that use this plugin at version 0.17 or earlier, including indirect dependencies.
• Configure an explicit state generator that draws from a cryptographically secure random source and has high entropy, rather than relying on the default.
• Review the referenced patch and check the plugin release page for a version the maintainer identifies as fixed before upgrading.
• Confirm that the application validates the state value on every OAuth2 callback and rejects responses that do not match the session.

Detection guidance

• Review OAuth2 callback logs for responses whose state value does not match a pending request in the user's session.
• Watch for bursts of authorization callbacks that were not initiated by the user, which can indicate forged requests.
• Keep the plugin's version visible in software inventories so that affected deployments can be found quickly.

Limitations of the available information

• The record has no structured affected version range, no fixed version and no confirmed patch status.
• The CWE name is null in the record and the source status is Deferred.
• EPSS and SSVC data are absent.
• The record does not say whether applications that supply their own state generator are affected.
• No independent testing or vendor analysis beyond the listed references was available.

References: NVD entry, MetaCPAN source, Openwall oss-security post.

Frequently asked questions

Is this vulnerability confirmed as exploited in the wild?

No. The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The description names versions through 0.17 of Mojolicious::Plugin::Web::Auth::OAuth2 for Perl. The structured affected list in the record is empty, so no more precise range is given.

Is a fixed version available?

The record does not state a fixed version. It references a patch file for release 0.17, but it does not confirm the patch's effect, so remediation status should be treated as unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.